Situation Awareness for Supervisory Control –

Revisiting the Vincennes Incident

Patrick Hew, Edward Lewis, Penelope Radunz, Sean Rendell

POC: Patrick.Hew@dsto.defence.gov.au

15th International Command & Control Research & Technology Symposium22-24 June 2010 (Santa Monica, California)

Synopsis

• Establish that situation awareness (SA) is different for “on” vs “in” the loop– Supervisory Control = “on” the loop

• Revisit the Vincennes Incident using “on” vs “in” the loop models– Identify specific failures in C2 design

across the human-machine system• C2 design principles for “on” the loop SA

– Design space that awaits exploitation

Outline

• Supervisory Control– Intelligent agents and the “loop”

• Situation Awareness (SA)– SA “in” vs “on” the loop

• Vincennes Incident Revisited– C2 system failed to support humans in their

“on” the loop role– Design principles for “on” the loop systems

• Implications for C2 Theory and Practice

Supervisory Control

• Sheridan Model of Supervisory Control

• Informally: “on” the loop– Versus human being “in” the control loop

T B Sheridan, Telerobotics, Automation, and Human Supervisory Control, Cambridge: MIT Press, 1992.

“One or more human operators are intermittently programming and continually receiving information from a computer that itself closes an autonomous control loop through artificial effectors to the controlled process or task environment.”

Relevance to Evolution of C2

• Vincennes Incident (1988)– US Navy warship downed Iranian Airbus– Prompted Tactical Decision Making Under

Stress (TADMUS) research programbut

– Framed under “in” the loop thinking• Supervisory control is USAF preferred

C2 concept for future unmanned systems– C2 design to support processes and behaviours

of supervisory control?

Intelligent Agents

• AI definition of Intelligent Agent

• No restrictions on an agents’ construction– Humans, machines, organisations, …

• Reconstruct Supervisory Control as

“Autonomous entity that observes and acts upon an environment and directs its activity towards achieving goals.”

S J Russell, P Norvig, Artificial Intelligence: A Modern Approach, 2nd Edition ed., Upper Saddle River, NJ: Prentice Hall, 2003.

“One or more operators are intermittently programming andreceiving information from an artificial intelligent agent.”

Task and Supervisor Agents

• Task Agent– Sense & Act

into environment• Supervisor Agent

– Sense from environment

– Receive Info from Task Agent

– Program Task Agent

Task Agent

ActSense

Program

EnvironmentSense

Receive Info

Supervisor

Task Loop

Supervisor Loop

“in”

“on”

Lethal Agents

• Lethal Agent– Particular form of Task Agent– Closes a firing loop from sensors to weapons

Situation Awareness

• Endsley model of Situation Awareness

M R Endsley, “Toward a Theory of Situation Awareness in Dynamic Systems,” Human Factors, 37(1), 1995, 32-64.

State of the environment

Perception of elements in current situation

Level I

Comprehension of current situation

Level II

Projection of future status

Level III

DecisionPerformance

of Actions

Feedback

Situation Awareness

“The perception of the elements in the environment within a volume of space, the comprehension of their meaning and the projection of their status in the near future.”

“Volume of space”

• Task Agent– “volume of space” is

the external world• Supervisor Agent

– “volume of space” is the state space of the Task Agent

– Sense from external world to calibrate the Task Agent

Task Agent

ActSense

Program

EnvironmentSense

Supervisor

Task Loop

Supervisor Loop

“in”

“on”

Environment

Task Agent

Receive Info

Vincennes Incident

• USS Vincennes shot down Iranian Airbus– State-of-the-art air warfare

combat system (Aegis)– Highly-trained crew,

considered fully-capable• Questions for analysis:

– Where were the “on” vs “in” the loop activities?– Were the humans supported in these activities?

USS Vincennes

USS Vincennes, 24-Oct-1988

USS Vincennes

SPY-1 Surveillance & Control Radar– Detect & track contacts, guide weapons

UPX-29 Interrogation Friend or Foe– Interrogate transponder on contacts

Air-Ground-Air Radio– Talk to aircraft via A-G-A communication frequencies

SPG-62 Fire Control Radar– Illuminate targets for SARH missiles

SM-2 Surface-to-Air Missile– Mid-course guidance with Semi-Active Radar Homing

Combat Information CenterUSS Vincennes, 1-Jan-1988

USS Vincennes

Timeline

UPX-29 reports IFF Mode II (Military). Identification Supervisor reports possible F-14. Own Ship Display Assistant updates screens used by Commanding Officer (CO) and Tactical Action Officer (TAO).

UPX-29 was not actually interrogating the Airbus. IFF “hooked” to TN 4131 symbol, but UPX-29 was actually interrogating the vicinity of Bandar Abbas.

No way of knowing whether radio calls had been received.

TN4131 3–4 Nm off COMAIR centre. Challenged over Military Air Distress Channel. Start multiple challenges on International Air Distress Channel.

Flight 655 was running 27 min late.

Identification Supervisor consulted COMAIR schedule, concluded that contact was not Iran Air Flight 655.

Interrogated by UPX-29, which saw IFF Mode III (Civilian).

Iran Air Flight 655 departs Bandar Abbas. Acquired by SPY-1 radar.

Reported as TN4474.Later renumbered to TN4131.

1017

1018

10191020

1020

Timeline

Had acknowledged earlier comment that the contact may have been a commercial airliner.

CO Vincennes searching for emissions to help identify “unknown-assumed hostile” contact.

TN4474 had been reassigned to an A-6 Intruder, then descending and accelerating.

CO asked for status on “TN4474”.

Contact crosses 20 Nm threshold.Illuminated with SPG-62.

Civilian aircraft not equipped to detect fire control radars.

1022

1023

TAO Side unable to gain attention of TAO Vincennes. CO Sides does not pass on evaluation.

USS Sides notes TN4131 continuing to climb. CO Sides evaluates TN4131 as non-threat.

1024 CO Vincennes orders launch of two SM-2 missiles.

Agents and Behaviours

• Lethal Agent and Supervisor were assembled from Vincennes systems and crew members

• C2 system failed to support the Supervisor, as seen in key events leading to the fratricide

Supervisor

Lethal Agent

Agents and Behaviours

• CO asked for TN4474– “Dangling pointer” error

• C2 Design Principle– Support the Supervisor

to track & debug errors in the Task Agent

Supervisor

Lethal Agent

Agents and Behaviours

• UPX-29 was not interrogating Airbus– Error in how equipment

was being used• C2 Design Principles

– Transporting and summarising info is not supervisory control

– Checking how info is gathered and used is supervisory control

Supervisor

Lethal Agent

Agents and Behaviours

• Airbus did not respond to radio calls nor fire-control radars– Error in formulation of

Rules of Engagement• C2 Design Principles

– Make the Task Agent’s program explicit

– Help Supervisor to predict the Task Agent’s behaviour

Supervisor

Lethal Agent

Agents and Behaviours

• Who was supervising?– Lethal Agent employed

everyone up to and including the CO

• C2 Design Principles– Supervisor is a distinct

role, with its own “loop”– Avoid double-hatting of

personnel to both “in”and “on” the loop

Supervisor

Lethal Agent

Implications for C2

• SA researchers should look for the loops, irrespective of composition or tempo– The Supervisory Control loop is somewhere …

trace the info flows (“on” the loop SA)– Very slow loop ≠ No loop

• C2 designers must recognise the Supervisor– Distinct activities and information– Distinct role with its own workload– Not a new requirement, was always present

but neither recognised nor addressed

Conclusions

• Established that situation awareness (SA) is different for “on” vs “in” the loop– Supervisory Control = “on” the loop

• Key events in Vincennes Incident can be traced to failures in supervisory control– C2 design failed to foster “on” the loop SA

• Future C2 systems ought to recognise the needs of supervisory control– Proposed some design principles